Email privacy is a broad topic dealing with issues of unauthorized access to, and inspection of, electronic mail, or unauthorized tracking when a user reads an email. This unauthorized access can happen while an email is in transit, as well as when it is stored on email servers or on a user's computer, or when the user reads the message. In countries with a constitutional guarantee of the secrecy of correspondence, whether email can be equated with letterstherefore having legal protection from all forms of eavesdroppingis disputed because of the very nature of email. In the United States, which does not have a constitutional guarantee of the secrecy of correspondence, precedents and laws derived from the Fourth Amendment provide limited protection for email.
An email has to go through potentially untrustworthy intermediate computers (email servers, ISPs) before reaching its destination, and there is no way to verify if it was accessed by an unauthorized entity. Through the process of information being sent from the user's computer to the email service provider, data acquisition is taking place, often without the user's explicit consent or knowledge. There are certain data collection methods (routers) that are used for data privacy concerns, but there are others that can be harmful to the user. This is different from a letter sealed in an envelope, where, by close inspection of the envelope, it might be possible to determine if it had been previously opened. In that sense, an email is much like a postcard, the contents of which are visible to anyone who handles it.
There are certain technological workarounds that make unauthorized access to email difficult, if not impossible. However, since email messages frequently cross national boundaries, and different countries have different rules and regulations governing who can access an email, email privacy is a complicated issue.
Companies may have email policies requiring employees to refrain from sending proprietary information and company classified information through personal emails or sometimes even work emails. Co-workers are restricted from sending private information such as company reports, slide show presentations with confidential information, or email memos.
In 2004, consumer privacy advocates and civil rights organizations urged Google to suspend Gmail over privacy rights concerns. The 31 organizations signed a letter calling upon Google to be more transparent about its information handling practices regarding data retention and sharing within its business units. They voiced concerns about Google’s plan to scan the text of all incoming messages with the information to be used for ad placement. They noted specific concerns regarding the scanning confidential email for inserting third party ad content, which violates the implicit trust of email service providers, possibly establishing a dangerous precedent.
Technological workarounds
There are some technical workarounds to ensure better privacy of email communication. Although it is possible to secure the content of the communication between emails, protecting the metadata, for instance who sent email to whom, is fundamentally difficult.Mattingly, Phil. "Why Email Can't Be Protected From Government Surveillance", MakeUseOf, 21 August 2013. Retrieved on 2 April 2015. Even though certain technological measures exist, the widespread adoption is another issue because of reduced usability.
Encryption
According to Hilarie Orman, mail encryption was first developed in the mid-1980s. She states that mail encryption is a powerful tool that protects one's email privacy. Although it is widely available, it is rarely used, with the majority of email sent at risk of being read by third parties. In general, encryption provides protection against malicious entities. However, a court order might force the responsible parties to hand over decryption keys, with a notable example being Lavabit. Encryption can be performed at different levels of the email protocol.
Transport level encryption With the original design of email protocol, the communication between email servers was plain text, which posed a huge security risk. Over the years, various mechanisms have been proposed to encrypt the communication between email servers. One of the most commonly used extension is STARTTLS. It is a TLS (SSL) layer over the plaintext communication, allowing email servers to upgrade their plaintext communication to encrypted communication. Assuming that the email servers on both the sender and the recipient side support encrypted communication, an eavesdropper snooping on the communication between the mail servers cannot see the email contents. Similar extensions exist for the communication between an email client and the email server.
End to end encryption
In end-to-end encryption, the data is encrypted and decrypted only at the end points. In other words, an email sent with end-to-end encryption would be encrypted at the source, unreadable to email service providers in transit, and then decrypted at its endpoint. Crucially, the email would only be decrypted for the end user on their computer and would remain in the encrypted, unreadable form to an email service, which would not have the keys available to decrypt it. Some email services integrate end-to-end encryption automatically.
OpenPGP is a data encryption standard that allows end-users to encrypt the email contents. There are various software and email-client plugins that allow users to encrypt the message using the recipient's public key before sending it. At its core, OpenPGP uses a Public Key Cryptography scheme where each email address is associated with a public/private key pair.
OpenPGP provides a way for the end users to encrypt the email without any support from the server and be sure that only the intended recipient can read it. However, there are usability issues with OpenPGP—it requires users to set up public/private key pairs and make the public keys available widely. Also, it protects only the content of the email, and not metadata—an untrusted party can still observe who sent an email to whom. A general downside of end-to-end encryption schemes—where the server does not have decryption keys—is that it makes server side search almost impossible, thus impacting usability.
Architectural impact
The architecture of the system also affects the privacy guarantees and potential venues for information leakage. The email protocol was originally designed for email clients—programs that periodically download email from a server and store it on the user's computer. However, in recent years, webmail usage has increased due to the simplicity of usage and no need for the end users to install a program. Secure messaging is in use where an entity (hospitals, banks, etc.) wishes to control the dissemination of sensitive information. Secure messaging functions similarly to webmail, in that the user must log on to a websiteoperated by the company or entity in questionto read received messages.
With both secure messaging and webmail, all email data is stored on the email provider's servers and thus subject to unauthorized access, or access by government agencies. However, in the case of email clients, it is possible to configure the client such that the client downloads a copy of the message as it arrives, which is deleted from the server. Although there is no way to guarantee whether a server has deleted its copy of an email, it still provides protection against situations where a benign email server operator is served with a court order.
Other workarounds
Although encryption provides for a way to protect the contents of the message, it still fails to protect the metadata. Theoretically, mix networks can be used to protect the anonymity of communication (who contacted whom).
Another workaround that has been usedKaplan, Eben. "Terrorists and the Internet" , Council on Foreign Relations, 8 January 2009. Retrieved on 2 April 2015. is to save a message as a draft in a webmail system, and share the webmail login credentials with an intended recipient. As an example of a dead drop, this method defeats any kind of monitoring based on the actual email sent. However, this method infamously failed to protect the privacy of the participants in the Petraeus scandal; after coming under investigation for unrelated activities, communication between the parties was accessed by the FBI.
Attachment file metadata Another aspect of email privacy is the risk that arises from embedded file metadata in email attachments. Such metadata can divulge privacy-compromising data, such as the names of authors, file revision history, and the location where a file was stored, both to unauthorized parties that gain access to the email message, as well as to the intended recipient. This problem can be mitigated by using a metadata removal tool. There are solutions that integrate with email clients as add-ins and remove metadata from outgoing email attachments just before they are sent. There are also server-based solutions that automatically remove metadata from outgoing email messages at the organization's network gateway, enforcing a consistent policy without relying on user action.
Legal standing
United States
Constitutional protection
Protection under the United States Constitution The Fourth Amendment to the United States Constitution provides that "[T]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated." This Amendment guarantees the privacy, dignity, and security of persons against certain arbitrary and invasive acts by officers of the government or those acting at their direction. The Fourth Amendment is often invoked to protect individual privacy rights against government activities.
In 2022, sociologist Zeynep Tufekci reflected on Louis Brandeis' 1890 law review article that helped establish the U.S. concept of the right to privacy and said "many of our existing legal protections are effectively outdated", including legal protections for email against .
In the case of employer emails, although the words “the people” may appear to be broad and to include any employee, this amendment (or any other part of the United States constitution) has not been interpreted to protect the privacy interest of private-sector employees. By contrast, public-sector employees of federal, state, and local governments usually have privacy protection under the United States Constitution.